In a very short space of time, Covid-19 has dramatically changed the way the world operates. As governments worldwide mandate social distancing to prevent disease transfer, there has been a significant rise in remote working. This has resulted in a range of issues for many SMEs.
In the office, employees work within the security perimeters that their company provides. When working from home, this safety precaution is difficult to maintain. Many home devices use a shared network environment, giving way to several unprotected endpoints. Crucially, this opens the door to a security breach. It goes without saying that home Wi-Fi networks are notoriously insecure. They often use factory-standard or basic passwords that can be easily hacked, whilst game consoles and ‘smart’ appliances offer a low-security gateway to fraudulent activity. Since the shift from the office to working from home, SMEs may find that their cybersecurity protocols no longer stack up as they fight to contend with the deluge of remote connections and cope with several dispersed endpoints. Cybercriminals have wised-up to this challenging time. They appreciate that each employee who works from home presents a new gateway into their company’s network.
According to Action Fraud, March saw a staggering 400 per cent global increase in cyberattacks. Heightened awareness, along with a revised implementation of cybersecurity, has never been more vital.
Endpoints and networks
Management of remote working involves deployment of key resources in a strategically sound manner without causing too much disruption. IT teams, who once had physical access to employee machines, now lack time and accessibility to address commonplace issues. An increased strain on networks is inevitable with the exponential uplift in remote connections and subsequent growth in threat surface. In the absence of on-site diagnostic teams, and to protect the network from the unknown, automated threat reporting and diagnostic tools become important components in the arsenal of enterprise cyber-defences. Endpoint Detection and Response (EDR) software is a relatively simple and cost-effective way of uncovering and eliminating potential cyberattacks. Deploying automated detect and response software means that IT departments can concentrate on responding to everyday IT issues whilst trusting that EDR to safeguard the network perimeter.
The same can be said about Virtual Private Network (VPN) software. In the office environment, where devices are connected automatically, most employees probably aren’t even aware of how their connections to the network are protected. When working remotely, it’s important that organisations educate their employees on how to connect to the company’s network without creating vulnerabilities. A VPN not only protects the business, it can protect the user at the remote connection from a major embarrassment by establishing a network gateway that can control traffic and disable connections easily. When EDR and VPN software are installed in conjunction with a comprehensive awareness training, cybersecurity is more robust, even with a remote workforce.
Phishing for information
While cybersecurity protocols provide SMEs with some level of reassurance and protection against an attack, more can be done to add to the layers of defence. As I mentioned earlier, people are a critical factor in effective cybersecurity and without adequate training and exposure to possible threats, employees can unwittingly invite cybercriminals into the network. Phishing attacks commonly target employees and rely on naivety for success. Last year, over half of cyberattacks in the UK involved phishing, and over 80 per cent of businesses were targeted. That number has grown exponentially in the past two months due to coronavirus-related cyberattacks. Google reported that Gmail users receive 18 million Covid-19 themed phishing emails every day. Link a successful phishing attack to a poorly configured or mismanaged security setting on the company network and one accidental click could be catastrophic for business.
Regular training can ensure that employees are suitably informed and aware of phishing attacks. By educating them on how to spot, report and remove suspicious emails, employees become empowered to provide the first line of defence against attackers. This can reduce the rate of successful attacks by over 60 per cent. Adopting a layered, strategic approach to internal training and cybersecurity solutions can help ensure that a company’s cybersecurity approach is fully capable of addressing and resolving cyber-threats.
Lead by example
Despite clear evidence for the benefits of internal education, a recent Make UK study found that one in three businesses do not have formal cybersecurity training in place for their employees. More alarmingly, it revealed that almost 50 per cent of the respondents lack a means to track the ongoing performance of their cybersecurity infrastructure. These statistics highlight an issue, commonplace in the business world, cybersecurity is simply not regarded as a Board-level responsibility.
Digital infrastructure has become the standard for modern businesses and therefore it is vital that cybersecurity is prioritised and owned by the Board of Directors. After all, a cyberattack can cause lasting damage and if operations are disrupted by it, it is the senior management and the Board that would be accountable. It’s therefore crucial that cybersecurity is a part of everyday operations, with regular check-ups and reports. This sentiment is echoed by the UK National Cybersecurity Centre who created a Board Toolkit to provide advice and encourage directors and technical experts to come together and discuss cybersecurity. By taking advantage of these resources, board members can ensure that their business remains protected.
The rapid, unprecedented move to home working has raised issues around our digital security. Cybercriminals are exploiting the current uncertainty and any loopholes in cyber-protocols. During this time of heightened risk, businesses of all sizes must take the steps outlined in this article to ensure they have a robust, comprehensive cybersecurity system. By doing this, you can safeguard against one of the greatest threats during the lockdown period.
Mitchell Scherr, CEO, Assured Cyber Protection
- Check out our list for the best firewall
